SECURITY (CVE-2012-0031): Fix possible crash on shutdown if a child

changes the sb_type field in the scoreboard.  Since unprivileged
children should not be able to affect the parent in this way, this is
treated as a Low severity security issue.

Thanks to "halfdog" <me halfdog.net> for reporting this issue.

* include/scoreboard.h (global_score): Remove sb_type field.

* include/ap_mmn.h: Bump MMN for above.

* server/scoreboard.c (ap_cleanup_scoreboard, ap_create_scoreboard):
  Use a static global to store store the scoreboard type.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1230065 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/include/ap_mmn.h b/include/ap_mmn.h
index 110a235a1adbb8358b6096cd8600d0ec4820f9b6..2f9e6bb0a691e33fc5abf8400b3eca6b74cbe8da 100644 (file)
--- a/include/ap_mmn.h
+++ b/include/ap_mmn.h
@@ -384,12 +384,13 @@
  *                         ap_proxy_table_unmerge(), proxy_lb_workers.
  * 20111203.1 (2.5.0-dev)  Add ap_list_provider_groups()
  * 20120109.0 (2.5.0-dev)  Changes sizeof(overrides_t) in core config.
+ * 20120111.0 (2.5.0-dev)  Remove sb_type from global_score.
  */
 
 #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
 
 #ifndef MODULE_MAGIC_NUMBER_MAJOR
-#define MODULE_MAGIC_NUMBER_MAJOR 20120109
+#define MODULE_MAGIC_NUMBER_MAJOR 20120111
 #endif
 #define MODULE_MAGIC_NUMBER_MINOR 0                   /* 0...n */
 

diff --git a/include/scoreboard.h b/include/scoreboard.h
index 8165d57ed3ebcf8e1720e45c86c046e4563fcb4f..31450056474e34dc2731338e14067e5f92b1a54c 100644 (file)
--- a/include/scoreboard.h
+++ b/include/scoreboard.h
@@ -120,7 +120,6 @@ struct worker_score {
 typedef struct {
     int             server_limit;
     int             thread_limit;
-    ap_scoreboard_e sb_type;
     ap_generation_t running_generation; /* the generation of children which
                                          * should still be serving requests.
                                          */

diff --git a/server/scoreboard.c b/server/scoreboard.c
index 72aa07045054db9b7a8d133d19df7982e0e009dd..42019955c08f2b2c994fa27fb632386dca069ffa 100644 (file)
--- a/server/scoreboard.c
+++ b/server/scoreboard.c
@@ -42,6 +42,7 @@
 
 AP_DECLARE_DATA scoreboard *ap_scoreboard_image = NULL;
 AP_DECLARE_DATA const char *ap_scoreboard_fname = NULL;
+static ap_scoreboard_e scoreboard_type;
 
 const char * ap_set_scoreboard(cmd_parms *cmd, void *dummy,
                                const char *arg)
@@ -276,7 +277,7 @@ apr_status_t ap_cleanup_scoreboard(void *d)
     if (ap_scoreboard_image == NULL) {
         return APR_SUCCESS;
     }
-    if (ap_scoreboard_image->global->sb_type == SB_SHARED) {
+    if (scoreboard_type == SB_SHARED) {
         ap_cleanup_shared_mem(NULL);
     }
     else {
@@ -329,7 +330,7 @@ int ap_create_scoreboard(apr_pool_t *p, ap_scoreboard_e sb_type)
         ap_init_scoreboard(sb_mem);
     }
 
-    ap_scoreboard_image->global->sb_type = sb_type;
+    scoreboard_type = sb_type;
     ap_scoreboard_image->global->running_generation = 0;
     ap_scoreboard_image->global->restart_time = apr_time_now();